ATM & Debit News
Operators of tens of thousands of off-premise automated teller machines are facing an imminent deadline to upgrade their equipment with mandated security protections or risk having them disconnected by the electronic funds transfer networks that switch their transactions.
"They're playing chicken with the networks," said Leon Majors, the president of Phoenix ESP Payments Research Group in Salisbury, Md. Phoenix ESP believes there are 30,000 to 60,000 off-premise ATMs in the United States that have yet to be upgraded to comply with the Triple Data Encryption Standard, he said.
Visa USA has given ATM operators until yearend to comply. However, previous Triple DES deadlines have been postponed, making some wonder how strictly the networks will force compliance now.
"Now they're saying 'no more extensions,' " said Sam Kandah, the president and CEO of NationalLink, an ATM independent sales organization in San Dimas, Calif. "So everybody is really pushing hard to get it done."
But because of the time pressure to replace old ATMs with machines that are Triple DES-compliant, a shortage of new ATM hardware has emerged, he said. This has led some in the industry to believe that Visa and MasterCard, which own the Plus and Cirrus ATM networks, respectively, will grant another extension, until March.
"It seems that everybody follows Visa and MasterCard's lead," Mr. Kandah said.
The large ATM networks would not comment on the deadline.
The Triple DES standard calls for data encryption to safeguard ATMs from intrusion by hackers and thieves who might use personal computers and software to capture transaction information. To satisfy the standard, operators must encrypt the keyboards and communication lines of older ATMs, generally those made before 2003.
Most ATMs made since 2003 are Triple DES-compliant. Banks have spent tens of millions of dollars to encrypt their ATMs. Independent sales organizations have been slower to respond, Mr. Majors said, because they are less risk-averse than banks and are more interested in just making money on ATMs.
Just more than 200,000 off-premise ATMs are serviced by ISOs, and about 212,000 are run by banks in branches, he said.
The cost of upgrading depends on the ATM. Mr. Kandah said it can range from $500 to $2,000 per machine, with the norm being $500 to $800.
Not every ATM is a profit maker; some machines get very little use. Therefore, some merchants might not see the sense of paying to upgrade their machines. Instead, they will keep them as they are until the networks shut them down. And some merchants might be betting that the networks will ultimately fail to enforce the Triple DES standard, observers said.
But many ISOs are fully engaged in upgrading their ATMs. "It's taking so much in resources and energy from everyone, in service and operations resources, and in money," Mr. Kandah said.
Both merchants and ISOs by now should have a good idea which ATM sites are unprofitable. "People have more knowledge now than when they signed in the first round," Mr. Majors said. "This time, there's not as much speculation because they know what they're drawing."
Triple DES is not the only issue on the minds of ISOs and merchants these days. Many contracts are reaching the ends of their cycles, so ISOs and merchants must decide which machines to keep operating.
ISO relationships could change as well. With many contracts expiring, some ISOs are telling big accounts that they will offer upgrades for free if the merchants switch their business over to them, Mr. Kandah said.
If many of the 30,000 or more machines noncompliant with Triple DES are shut down, Mr. Majors said, it could help boost transactions at other ATM sites.
